Expose bind mounts from one container to another in rootless mode

[andreluisos]

/kind bug

Can't expose fuse mounts from one container to another in rootless

I got two test containers doing the same thing. The second container, however, is trying to mount the mounts from the first container using "--volumes-from" in rootless mode.

The folder is created inside the second container, but nothing inside.

podman run --rm -dt \
--name=test1 \
--privileged \
--volume ~/rclone:/config/rclone \
--volume ~/data/mount:/test1 \
--user 1000:1000 \
--volume /etc/passwd:/etc/passwd:ro --volume /etc/group:/etc/group:ro \
--device /dev/fuse \
--security-opt apparmor=unconfined \
rclone/rclone \
mount remote-crypt:/test /test1 \
--allow-other \
--allow-non-empty

podman run --rm -dt \
--name=test2 \
--privileged \
--volume ~/rclone:/config/rclone \
--volume ~/data/mount:/test2 \
--user 1000:1000 \
--volume /etc/passwd:/etc/passwd:ro --volume /etc/group:/etc/group:ro \
--device /dev/fuse \
--security-opt apparmor=unconfined \
rclone/rclone \
mount remote-crypt:/test /test2 \
--allow-other \
--allow-non-empty

I can see the test1 directory in the test2 container, but theres nothing inside.

I know exposing the mount to the host isn't possible in rootless mode: #10207

Output of podman version:

Version:      3.4.4
API Version:  3.4.4
Go Version:   go1.17.4
Git Commit:   f6526ada1025c2e3f88745ba83b8b461ca659933
Built:        Thu Dec  9 15:30:40 2021
OS/Arch:      linux/amd64

Output of podman info --debug:

host:
  arch: amd64
  buildahVersion: 1.23.1
  cgroupControllers:
  - memory
  - pids
  cgroupManager: systemd
  cgroupVersion: v2
  conmon:
    package: /usr/bin/conmon pertence a conmon 1:2.0.32-1
    path: /usr/bin/conmon
    version: 'conmon version 2.0.32, commit: 436b460d1586c2e4ab4e845448449ddd9136767a'
  cpus: 4
  distribution:
    distribution: arch
    version: unknown
  eventLogger: journald
  hostname: test
  idMappings:
    gidmap:
    - container_id: 0
      host_id: 1000
      size: 1
    - container_id: 1
      host_id: 100000
      size: 65536
    uidmap:
    - container_id: 0
      host_id: 1000
      size: 1
    - container_id: 1
      host_id: 100000
      size: 65536
  kernel: 5.15.13-arch1-1
  linkmode: dynamic
  logDriver: journald
  memFree: 1982214144
  memTotal: 16645586944
  ociRuntime:
    name: crun
    package: /usr/bin/crun pertence a crun 1.4-1
    path: /usr/bin/crun
    version: |-
      crun version 1.4
      commit: 3daded072ef008ef0840e8eccb0b52a7efbd165d
      spec: 1.0.0
      +SYSTEMD +SELINUX +APPARMOR +CAP +SECCOMP +EBPF +CRIU +YAJL
  os: linux
  remoteSocket:
    path: /run/user/1000/podman/podman.sock
  security:
    apparmorEnabled: false
    capabilities: CAP_CHOWN,CAP_DAC_OVERRIDE,CAP_FOWNER,CAP_FSETID,CAP_KILL,CAP_NET_BIND_SERVICE,CAP_SETFCAP,CAP_SETGID,CAP_SETPCAP,CAP_SETUID,CAP_SYS_CHROOT
    rootless: true
    seccompEnabled: true
    seccompProfilePath: /etc/containers/seccomp.json
    selinuxEnabled: false
  serviceIsRemote: false
  slirp4netns:
    executable: /usr/bin/slirp4netns
    package: /usr/bin/slirp4netns pertence a slirp4netns 1.1.12-1
    version: |-
      slirp4netns version 1.1.12
      commit: 7a104a101aa3278a2152351a082a6df71f57c9a3
      libslirp: 4.6.1
      SLIRP_CONFIG_VERSION_MAX: 3
      libseccomp: 2.5.3
  swapFree: 5223268352
  swapTotal: 8322777088
  uptime: 74h 48m 50.48s (Approximately 3.08 days)
plugins:
  log:
  - k8s-file
  - none
  - journald
  network:
  - bridge
  - macvlan
  volume:
  - local
registries: {}
store:
  configFile: /home/test/.config/containers/storage.conf
  containerStore:
    number: 2
    paused: 0
    running: 2
    stopped: 0
  graphDriverName: overlay
  graphOptions: {}
  graphRoot: /home/test/.local/share/containers/storage
  graphStatus:
    Backing Filesystem: btrfs
    Native Overlay Diff: "true"
    Supports d_type: "true"
    Using metacopy: "false"
  imageStore:
    number: 3
  runRoot: /run/user/1000/containers
  volumePath: /home/test/.local/share/containers/storage/volumes
version:
  APIVersion: 3.4.4
  Built: 1639074640
  BuiltTime: Thu Dec  9 15:30:40 2021
  GitCommit: f6526ada1025c2e3f88745ba83b8b461ca659933
  GoVersion: go1.17.4
  OsArch: linux/amd64
  Version: 3.4.4

Have you tested with the latest version of Podman and have you checked the Podman Troubleshooting Guide? (https://github.com/containers/podman/blob/main/troubleshooting.md)

Yes

[giuseppe]

you need to manually configure a mount on top of a parent of ~/data/mount from the podman unshare environment and make it shared. Then you have to bind mount that parent you made shared inside the container. e.g.

$ podman unshare mount --bind --make-shared ~/data ~/data

[Luap99]

I think you can directly use -v /data:/data:shared, no?

[giuseppe]

If data is not a mount point, it won't be propagated I think

[andreluisos]

If data is not a mount point, it won't be propagated I think

I think you can directly use -v /data:/data:shared, no?

Both were necessary.
Thank you!

[rhatdan]

This is not an issue but a discussion on how to do something.